feat(12-02): OIDC boot env-OR-app_config fallback + pre-auth mount verification

- A2 CONFIRMED: @hono/oidc-auth reads OIDC_ISSUER/OIDC_CLIENT_ID/OIDC_AUTH_EXTERNAL_URL
  at per-request call time (env(c) → process.env), NOT at import time — fresh instance
  boots cleanly without OIDC env vars
- Implement oidcConfigFallbackMiddleware in auth/middleware.ts: reads OIDC_ISSUER,
  OIDC_CLIENT_ID, OIDC_AUTH_EXTERNAL_URL from app_config when process.env is absent,
  injects into process.env before oidcAuthMiddleware() reads it (D-02/D-03/Recommendation a)
- Mount oidcConfigFallbackMiddleware before oidcAuthMiddleware() in index.ts so
  wizard-configured instances work before a container restart
- Verify /api/setup mount order: line 49 < devAuthBypass line 54 (T-12-09/Pitfall 1)
- Fix push.test.ts vi.doMock for middleware.js: add oidcConfigFallbackMiddleware stub
- 394 tests pass | 5 todo (D-08 RED scaffolds); typecheck clean

apps/api/src/index.ts

@@ -11,7 +11,11 @@ import { listsRouter, listItemsRouter } from './routes/lists.js';
 import { pushRouter } from './routes/push.js';
 import { adminRouter } from './routes/admin.js';
 import { setupRouter } from './routes/setup.js';
-import { oidcAuthMiddleware, processOAuthCallback } from './auth/middleware.js';
+import {
+  oidcAuthMiddleware,
+  processOAuthCallback,
+  oidcConfigFallbackMiddleware,
+} from './auth/middleware.js';
 import { devAuthBypass } from './auth/devBypass.js';
 import { persistSessionCookie } from './auth/persistSessionCookie.js';
 import { startBrokerPoller } from './broker/poller.js';
@@ -56,6 +60,13 @@ app.use('/api/*', devAuthBypass());
 // OIDC_AUTH_EXTERNAL_URL is MANDATORY behind Pangolin to construct the correct
 // redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
 if (!devBypassActive) {
+  // Phase 12 / D-02 / D-03: env-OR-app_config fallback for non-secret OIDC config.
+  // Reads OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_AUTH_EXTERNAL_URL from app_config when
+  // absent from process.env — so a fresh unconfigured instance does not crash at boot
+  // and a wizard-configured instance reads the DB values before a container restart.
+  // A2 CONFIRMED: oidcAuthMiddleware() reads process.env per-request (call time), so
+  // injecting into process.env here is safe and effective (see auth/middleware.ts A2 note).
+  app.use('/api/*', oidcConfigFallbackMiddleware);
   app.use('/api/*', oidcAuthMiddleware());
   // Re-issues the session-scoped oidc-auth cookie as persistent so PWA sessions survive close (AUTH-02).
   app.use('/api/*', persistSessionCookie());